How to Block Google FLoC Web Tracking System

Why you need to Block Google FLoC, the new tracking tool designed to replace third-party cookies with their own surveillance and tracking.

What is Google FLoC?

Google's FLoC, or Federated Learning of Cohorts, is supposed to protect user privacy by replacing third-party cookies. In reality, it is a new surveillance mechanism from Google. It uses the browser to track your website browsing history and learn about your interests. Google then uses this data to put you in a "cohort", a group of individuals having similar interests.

Suppose you want to avoid showing an interest-based advertisement on your website. In that case, you can opt-out by implementing Permissions Policy headers. FLoC is designed to replace third-party cookies with its user surveillance built-in browser.

Why You Need To Block Google FLoC

Google FLoC is another tracking system that gathers more data about you. There isn't a way to opt out of it; the only options are to use the old system of third-party cookies or the new FLoC system. They are different from a security and privacy perspective, so FLoC does not solve the problem.

Google FLoC is creating digital fingerprinting on a per-user basis. Whilst they say that websites cannot track you as an individual on the cohort to which you belong, we can guess that Google still uses this to track every click. Some security researchers have also criticized Google FLoC for being another data point that websites can use to track you, which makes their tracking even more effective.

Privacy-concerned people can switch to another privacy-concerned browser to avoid being tracked. DuckDuckGo, Vivaldi, and Brave have announced they will block Google's FLoC tracking system out of the box.

Website owners can also opt out of FLoC by modifying their web server's HTTP response header.

As a user, you can check out this dedicated page (Am I FloCed?) to see if you're being tracked with FLoC.

How to Block Google FLoC on a Website

Blocking FLoC is (at the moment) as easy as adding a custom header to your HTTP responses.

Permissions-Policy: interest-cohort=()

The method will vary depending on the platform you are running. Here are a few common examples.

Apache Web Server

The easiest way to block FLoC on Apache servers is to add these lines to the .htaccess file or global configuration file.

<IfModule mod_headers.c>
  Header always set Permissions-Policy: interest-cohort=()
</IfModule>

WordPress

You can add this code to your themes functions.php or create a plugin.

add_filter(
'wp_headers',
function ( $headers ) {
if ( empty( $headers['Permissions-Policy'] ) ) {
$headers['Permissions-Policy'] = 'interest-cohort=()';
} elseif (
! empty( $headers['Permissions-Policy'] )
&& false === strpos( $headers['Permissions-Policy'], 'interest-cohort' )
) {
$headers['Permissions-Policy'] .= ', interest-cohort=()';
}

return $headers;
}
);